US phone companies could face fines for weak security under a proposed new rule